What to include
- what you found, and where: the page, address or product;
- the steps to reproduce it;
- what an attacker could do with it, as you understand it;
- how we can reach you for questions.
What we ask of you
- Give us a reasonable time to investigate and fix the issue before you make it public.
- Don’t access, change or delete data that isn’t yours, and stop as soon as you have shown the problem.
- Don’t run tests that degrade the service for others, such as denial-of-service attacks.
- Don’t use social engineering, phishing or physical attacks.
What we will do
We will acknowledge your report, look into it, and keep you informed while we work on it.
Machine-readable contact
Our security contact is also published in the standard format at /.well-known/security.txt.